Trojan.StartPage.57939

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsi2.tmp\InetLoad.dll
%HOMEPATH%\Desktop\Internet Hao123nknk
%TEMP%\nsi2.tmp\System.dll
%TEMP%\nsi2.tmp\Math.dll

Удаляет следующие файлы:

%TEMP%\nsi2.tmp\System.dll
%TEMP%\nsi2.tmp\Math.dll
%TEMP%\nsi2.tmp\InetLoad.dll

Сетевая активность:

Подключается к:

'bi##.#antule.net':5735
'17#.#95.249.133':8511
'cv#.#antule.net':7034

UDP:

DNS ASK bi##.#antule.net
DNS ASK to####.kantule.net
DNS ASK cv#.#antule.net

Другое:

Ищет следующие окна:

ClassName: 'xtnvjsjblstmrthvsvlbsuiomzavlzijyoaf' WindowName: 'dovgtedsrojudbhwqdx'
ClassName: 'gdqfhjdflhcyezzxfjaa' WindowName: 'jweescfkuwoypnjwdlpsxoho'
ClassName: 'vutspvutyygnnnpgmdqbi' WindowName: 'crygddzuxjubszhuupkl'
ClassName: 'vpsewyevkznifwbwdnvuaeyesdadnksz' WindowName: 'nfoyuoyosnntimqvxrjmrpq'
ClassName: 'eseatuuoxaigvsbzwpkwemibgeoz' WindowName: 'nnhyswemuapowlhwqqyjaojmylpwuhrgc'
ClassName: 'jeyujwsnfawqmacjincqturklibpgkcagyfju' WindowName: 'urvykebqikceztnnlaqcrubbblshocpxq'
ClassName: 'hbzhebnxwxjcznhqgkugtmolegzws' WindowName: 'zcxwokscflnudqtkdqhlsfkohzzczlvndrl'
ClassName: 'cgrqanpiinjhhdpiy' WindowName: 'argcbherinpspnyhxekimvzrbczkmk'
ClassName: 'zwfjcrijiusgrldbrmnrlpwzns' WindowName: 'nyrijpuzyewksfoxppgkohukqphcqc'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'xpdqqmhujqeiblpqqeblajqgacgid' WindowName: 'ryepyeoetakpfudptf'
ClassName: 'mcapsznpbxanyrhvpqlwcdrkpmhckd' WindowName: 'lhrkfjzzbnvuhpazrdsbxaivck'
ClassName: 'ewzojvynrpjcswitqlegp' WindowName: 'vnnyvxvhxfawlphuwszzx'
ClassName: 'sdeqeqapxndenlhcyru' WindowName: 'gsyfqkafkthgngqlsuhkjdquxce'
ClassName: 'zywzrwsxjdylkssjyqhdjulygskuqgfhqcvcs' WindowName: 'pzagjrjglnkluscdhtuphodorpveebzrnaspj'
ClassName: 'zoyjdvckgxnkvmtybxxarwwfcjklulb' WindowName: 'csobxdttixbdllmrxqsymxzop'
ClassName: 'ttkyobmtrzkjsitjkbiqbbotvpajyxpmcxh' WindowName: 'poldbbqzpnwiaqvykcygvdzoknfrbnarcchxyw'
ClassName: 'ghfsuhfipembgphvylwasanirxzafwdfh' WindowName: 'cclzxsljdfwswivxdvlsrbjw'
ClassName: 'tlrtsrrowlkbzcjkrl' WindowName: 'dxqhnukwutxsdcczmwihougwfdakp'
ClassName: 'rrudzlzpzxljtbtgmxllikchsyil' WindowName: 'wtolcgvvgxdyvlm'
ClassName: 'rsguycdciduqlidgjadhwuqyxqgwbpobhver' WindowName: 'wjgtzzqnpkrceleljdrczmrr'
ClassName: 'oaeeuzymusvvacytxghobndraahnouvdlzrjqzd' WindowName: 'iqnompcjqlzqcwquzoryu'
ClassName: 'rvnknocyuoxpyuxb' WindowName: 'mclmepadpzvcjto'
ClassName: 'gyhhboztibisouaolcgarexoildilb' WindowName: 'aeonwlzwgegoxnfbrr'
ClassName: 'bcyuotqeniznylbzh' WindowName: 'kjsveefvrtoopzglrbdunasmxhqamj'
ClassName: 'ifeiddpcqkfzmbmhnccakgzgyxnqqmw' WindowName: 'gafxuqpqbdguqycxihosyaqkxvrwpgdaekcwax'
ClassName: 'xinvjqylediygirbdquzxsmiojbjciiqd' WindowName: 'njgwelglgujxobk'
ClassName: 'fmictreaikczibwfqayhnxmsgbioahbz' WindowName: 'dannidglvizasjnaon'
ClassName: 'ymkxjqilxfdyfeqpnlrn' WindowName: 'sxhlrclulunkawsivtneouvggfiqcrwcxql'
ClassName: 'sxnmoycpfumldbmv' WindowName: 'vmkuwapgyxlqgmiunhsfspihsfijejfxac'
ClassName: 'dxeucheuphvrjclanxgczhehdhijgmxbotor' WindowName: 'woinbaosvfqjkxqpwuwlesgvpp'
ClassName: 'mfryhvivaxjzuvkferjos' WindowName: 'nvigdooufqvkygwhduca'
ClassName: 'aagrutcznuzeuepircvlfdaxbp' WindowName: 'xfnjqsckpezquynyssnqlyautuduwb'
ClassName: 'achgvovkxclurbawcwle' WindowName: 'nhjemvhvlbnlnbfj'
ClassName: 'smizxkzsttpwlzdrpwnfwskuygvqwihrehh' WindowName: 'jlhhccsluyehftwqchoq'
ClassName: 'zcrjyjmhdmjteyykqvvxbexasvr' WindowName: 'wjaavjrlhsuidov'
ClassName: 'ogamcydivmvcfrfoopoqiuqvonp' WindowName: 'kxisoylihnlvgbyawlqpydt'
ClassName: 'sxoldjjhovclybequxkzomshsuncdbfkty' WindowName: 'uczmkpbhfymmldpulratqbceavcba'
ClassName: 'jqquutpcmspovbisjauprbubuwcfjl' WindowName: 'poprmmiejstmsfyqzuzigpdrlqhradgpcheqn'
ClassName: 'vbrorhutnerfzytmtkbiyvmcistyomdzugz' WindowName: 'updbiafgufvbjlcdrcn'
ClassName: 'yphugrkygorwfgarghqw' WindowName: 'yfqyfbdbmimpwivzwjiofsivzfijkrjjkqkt'
ClassName: 'czrnickcxudsdsbnagcvmzgwpknahndjokfrnas' WindowName: 'fbulbkyehgsbetwwepbferrzmefojfk'
ClassName: 'aszfojrdcamirqtheypmpmhokemg' WindowName: 'cwhlftpazatobvxqsffelrrsehcn'
ClassName: 'lvihmacgglwdoctinuxnkoln' WindowName: 'tgwaonnwyvbubuoxjj'
ClassName: 'ajcskzwyrsvewhzzzbgztmfgdufgfzz' WindowName: 'vymjatmsvmwzpnhhazenlkdapfbouqdor'
ClassName: 'cnjfsnqefjwtxykepdzjp' WindowName: 'pmmqjhcxzkydmonfnfagdjhrlk'
ClassName: 'mdxmwtlfdrmhzewhyopwactkxns' WindowName: 'ksshvmdibfwprmyrhhvjetkd'
ClassName: 'bwahanvksmrichxkerkwjwlskok' WindowName: 'hhccccuujrkisnzdcnukvrllorkvrmsmdquacdo'
ClassName: 'bojiwxmctjbnlhhodimrfhchiuswgrtnrmtbzl' WindowName: 'ofxlliyzylymbbgg'